CVE-2025-4318

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-4318
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-4318.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-4318
Aliases
Published
2025-05-05T18:16:34Z
Modified
2026-08-12T03:51:17Z
Severity
  • 9.0 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CVSS Calculator
Summary
Input validation issue in AWS Amplify Studio UI component properties
Details

The AWS Amplify Studio UI component property expressions in the aws-amplify/amplify-codegen-ui package lack input validation. This could potentially allow an authenticated user who has access to create or modify components to run arbitrary JavaScript code during the component rendering and build process.

Database specific 
{
    "cna_assigner": "AMZN",
    "cwe_ids": [
        "CWE-95"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/4xxx/CVE-2025-4318.json"
}
References

Affected packages

Git / github.com/aws-amplify/amplify-codegen-ui

Affected ranges

Type
GIT
Repo
https://github.com/aws-amplify/amplify-codegen-ui
Events
Introduced
57498039a3b6e39f8a47ea5e5770fe4a7639b51e
Fixed
ca98c38b7c3d69ae7c94d2f62b51e32e8165dae6
Fixed
de7590988109e4773cda7d02d60071b2721bee48
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0.1.0"
        },
        {
            "fixed": "2.20.3"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

@amzn/amplify-ui-codegen-schema@0.*
@amzn/amplify-ui-codegen-schema@0.1.0
@amzn/amplify-ui-codegen-schema@0.2.0
@amzn/studio-ui-codegen-react@0.*
@amzn/studio-ui-codegen-react@0.1.0
@amzn/studio-ui-codegen-react@0.2.0
@amzn/studio-ui-codegen@0.*
@amzn/studio-ui-codegen@0.1.0
@amzn/studio-ui-codegen@0.2.0
@amzn/test-generator@0.*
@amzn/test-generator@0.1.0
@amzn/test-generator@0.2.0
v0.*
v0.10.0
v0.10.1
v0.11.0
v0.11.1
v0.12.0
v0.13.0
v0.13.1
v0.6.0
v0.7.0
v0.8.0
v0.9.0
v1.*
v1.0.0
v1.1.0
v1.2.0
v2.*
v2.0.0
v2.1.0
v2.1.1
v2.1.2
v2.10.0
v2.11.0
v2.11.1
v2.12.0
v2.12.1
v2.12.2
v2.13.0
v2.13.1
v2.14.0
v2.14.1
v2.14.2
v2.14.3
v2.15.0
v2.15.1
v2.15.2
v2.15.3
v2.15.4
v2.15.5
v2.15.6
v2.15.7
v2.15.8
v2.15.9
v2.16.0
v2.17.0
v2.18.0
v2.19.0
v2.19.1
v2.19.2
v2.19.3
v2.19.4
v2.2.0
v2.2.1
v2.20.0
v2.20.1
v2.20.2
v2.3.0
v2.3.1
v2.3.2
v2.4.0
v2.4.1
v2.4.2
v2.5.0
v2.5.1
v2.5.2
v2.5.4
v2.5.5
v2.5.6
v2.5.7
v2.5.8
v2.6.0
v2.7.0
v2.7.1
v2.7.2
v2.8.0
v2.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-4318.json"